Pass-the-hash persists because Windows still trusts stolen hashes

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OLOID's blog post: Pass-the-hash attacks still work because stolen NTLM hashes can be replayed to authenticate across Windows environments without the plaintext password.

Why it matters: This matters because identity teams still have to govern hash exposure, local admin sprawl, NTLM dependencies, and privileged account use on shared and frontline devices.

By the numbers:

• The Hive ransomware group hit more than 1,300 companies and collected about $100 million in ransom payments by November 2022.

Context

Pass-the-hash is a credential abuse pattern, not a password-cracking problem. The control failure starts when a Windows environment lets a reusable hash remain available on endpoints that also carry administrative access and broad workstation trust.

That makes the issue relevant to identity threat detection and response as much as to Windows hardening. Once a hash can be replayed across SMB, RPC or WMI sessions, identity governance has to treat the credential material itself as a lateral movement asset, not just the account behind it.

The attack is especially dangerous where shared devices, reused local administrator passwords, and routine privileged troubleshooting overlap. In those environments, one exposed hash can travel far beyond the machine where it was first obtained.

Key questions

Q: What should teams do first when pass-the-hash activity is suspected?

A: First confirm the scope by correlating authentication and endpoint telemetry, then isolate affected hosts, reset exposed privileged credentials, and block further NTLM-based logons from compromised machines. Pass-the-hash usually means the hash can be replayed without the cleartext password, so focus on containment, session revocation, and hunting for lateral movement using the same account or token across systems.

Q: Why does a stolen NTLM hash let attackers move laterally?

A: A stolen NTLM hash can be reused to authenticate without knowing the password, so the attacker can present the hash in the challenge-response exchange and obtain access as that user. If the account has local admin or network privileges, the same hash can often open other hosts, making lateral movement possible across systems that trust the credential.

Q: How do local admin passwords affect pass-the-hash risk?

A: Unique, rotated local admin credentials reduce pass-the-hash risk by preventing the same local administrator hash from working on every endpoint. When each machine has a different password and it is changed regularly, a stolen hash from one host is far less useful for moving laterally to other systems with the same local admin account.

Q: How do you detect pass-the-hash attacks on Windows?

A: Detect it by finding logons that use NTLM in ways that do not match the user’s normal behaviour, especially when credentials are reused from a compromised host. Look for lateral movement between Windows systems, repeated authentications with the same account from different machines, and remote service creation. Prioritise domain admins and other privileged accounts.

Technical breakdown

Why NTLM hashes still enable authentication replay

NTLM uses challenge-response authentication, but the server is still relying on a password-derived secret rather than the password itself. If an attacker obtains the NT hash, they can answer the challenge without knowing the plaintext password. That is why pass-the-hash is not a decryption problem. It is a trust problem in a protocol that accepts reusable credential material. NTLMv2 improves the exchange, but it does not change the fundamental fact that the hash remains usable as an authenticator. See the MITRE ATT&CK T1550 Use Alternate Authentication Material Guide.

Practical implication: Reduce NTLM dependence where possible and treat hash exposure as credential compromise, not just password leakage.

How LSASS, SAM and NTDS.dit become hash sources

Attackers with sufficient local privilege look for credential material in places Windows already uses to support logon. LSASS memory can contain active or recent session material, the SAM database stores local account hashes, and NTDS.dit holds directory data for domain accounts on controllers. Each source differs in scope, but the security mistake is the same: privileged access to an endpoint or controller can expose reusable identity material that was never meant to be broadly accessible. See the Credential Dumping Guide.

Practical implication: Protect the credential stores that can reveal reusable hashes and isolate systems where privileged logons occur.

How pass-the-hash turns one foothold into lateral movement

Pass-the-hash usually starts after an attacker has already landed on a host and escalated locally. From there, the stolen hash is replayed over standard administrative paths such as SMB, RPC or WMI, which are legitimate protocols but become hostile when the presented identity is stolen. Each successful hop can reveal additional hashes, including privileged ones, until the attacker reaches domain-level access or another high-value system. See the Lateral Movement Guide.

Practical implication: Segment administrative paths and monitor for workstation-to-workstation authentication that fits no normal user pattern.

Threat narrative

Attacker objective: The attacker wants durable authenticated access that bypasses password knowledge and expands into domain-level control.

1. Entry begins when an attacker gets a foothold through phishing, malware or another initial access path and then elevates locally to reach credential material.
2. Credential access follows when LSASS, the SAM database or NTDS.dit yields an NTLM hash that can be replayed without cracking the password.
3. Escalation and lateral movement occur as the attacker uses the stolen hash over SMB, RPC or WMI to reach more systems, often harvesting more hashes along the way.
4. Impact arrives when a privileged hash opens domain-wide control, enabling ransomware deployment or data exfiltration.

Breaches seen in the wild

• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Pass-the-hash is a governance failure in credential material, not just an authentication weakness. The attacker does not need the password once the hash is available, so the control boundary has already been crossed before sign-in begins. That means identity programmes have to govern where hashes can be exposed, how long they remain useful, and which accounts are allowed to leave reusable material on endpoints.

Standing local admin exposure is the real blast-radius multiplier. Reused local administrator passwords turn one stolen hash into many machines, which is why this pattern keeps recurring in flat Windows estates. pass-the-hash and pass-the-ticket controls matter here because tiering, unique local admin credentials and privileged account separation all reduce the number of places a hash can be replayed.

Protected Users and LAPS address different failure modes, and both matter. One limits whether privileged accounts can authenticate with NTLM at all, while the other prevents a single local admin password from spreading across a fleet. Practitioners should read this as a split between protocol risk and password reuse risk, not as interchangeable defences.

Shared workstations create identity blast radius by design. When multiple users and administrators sign in to the same endpoint, credential material accumulates in memory and attribution becomes harder. That is a structural problem for frontline environments, because the compromise of one device can expose many identities and turn ordinary access into lateral movement leverage.

NTLM deprecation pressure is a security signal, not a cosmetic platform change. Microsoft's phased move away from default network NTLM reflects the fact that the protocol keeps extending the life of stolen hashes. Organisations that still depend on it should treat every remaining NTLM dependency as a deliberate exception with governance attached.

What this signals

Pass-the-hash exposure should be tracked as a credential-material problem, not only as an endpoint threat. Identity programmes that still tolerate broad NTLM use are preserving the conditions that make hash replay viable. The practical signal is simple: if the same account can authenticate from many machines, the replay window is still open.

Shared-device governance needs a different control model from standard workstation policy. Frontline endpoints concentrate logon activity, cached material and privileged troubleshooting into the same place, which expands the consequence of one compromised session. That means the governance question is not whether shared devices are useful, but whether they are allowed to accumulate reusable credentials at all.

Hash replay becomes harder to justify when authentication and attribution are separated cleanly. Individual sign-in, tiered admin access and rapid sign-out reduce the material an attacker can steal and make suspicious reuse easier to isolate. The next maturity step is to stop treating pass-the-hash as a niche Windows issue and start treating it as a fleet-wide identity design flaw.

For practitioners

• Reduce NTLM dependencies Inventory the systems that still require NTLM, then move those workflows to Kerberos or other supported authentication paths before blocking legacy usage broadly.
• Protect endpoint credential material Enable Credential Guard and LSA protection on systems that handle privileged logons so LSASS cannot be read by ordinary tooling.
• Remove reused local administrator passwords Deploy unique, rotated local admin passwords with Windows LAPS so one exposed local hash cannot unlock an entire workstation fleet.
• Constrain privileged logons to tiered systems Require domain admins and other high-value accounts to sign in only on dedicated administrative workstations and controller tier assets.
• Monitor NTLM replay indicators Correlate logon type 3 and logon type 9 events, LSASS access attempts and workstation-to-workstation SMB traffic to surface likely hash replay.

Key takeaways

• Pass-the-hash succeeds because Windows accepts a reusable NTLM-derived secret, which means the compromise starts when hashes become reachable, not when passwords are guessed.
• The attack becomes far more dangerous when local admin passwords are reused, privileged accounts log on to ordinary endpoints, and NTLM remains enabled across the estate.
• Credential Guard, LSA protection, Windows LAPS and tighter NTLM governance change the attacker's economics by shrinking both hash exposure and replay reach.

Related NHI Mgmt Group resources: Credential Dumping Guide · Pass-the-Hash and Pass-the-Ticket Guide · Identity Threat Detection and Response (ITDR) Guide · Lateral Movement Guide · Endpoint Privilege Management Guide

Key terms

• Pass-the-Hash: An authentication abuse technique where an attacker uses a stolen password hash instead of the cleartext password. It matters in Windows environments because cached credentials can sometimes be enough to gain access, turning one compromised host into a broader lateral movement opportunity.
• NTLM: NTLM is a Microsoft challenge-response authentication protocol used to prove a user or computer’s identity without sending the password itself. Attackers abuse it through relay, pass-the-hash, and credential capture attacks, so defenders should restrict NTLM use, prefer stronger authentication, and monitor where NTLM is still accepted.
• NT Hash: An NT hash is the Windows representation of a user password used in authentication workflows. If attackers steal the hash, they may be able to reuse it to impersonate the account on systems that accept hash-based authentication. Protecting NT hashes requires reducing exposure, limiting privilege, and detecting memory scraping.
• LSASS: LSASS is the Windows process that enforces local security policy and handles authentication-related operations. If LSASS crashes, the domain controller can reboot or lose authentication capability, making it one of the most sensitive failure points in enterprise identity infrastructure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.